Setup SonarQube vulnerability scanner

[matteopessina]

As a Security Auditor I expect source code to be inspected by SonarQube security scanner.

[Krusty93]

As a Security Auditor I expect source code to be inspected by SonarQube security scanner.

@matteopessina What do you think if we use the SonarCloud free tier for a static analysis in PR builds?